Intrusion Detection
Because ARP spoofing requires an attacker to send traffic, network IDSs can detect this attack.
Cisco network IDS5 has a few signatures related to ARP spoofing based on the ATOMIC.ARP engine.
A free tool, ARPwatch6, can detect an ARP spoofing attack. Typically, ARPwatch runs on a Linux host and processes all ARP packets on an attached Ethernet segment. ARPwatch executes multiple checks on the ARP packets: Is it a malformed packet? Is it a new MAC address (this is a MAC address never seen on the network)? Is it a new MAC address for an old IP address (probably a sign of an ARP spoofing attack)? ARPwatch generates alerts by sending an e-mail to an administrator. Example 6-9 shows the e-mail sent when a new MAC address appears on the network. It will then be up to the administrator to check whether this new MAC address is a valid one (this is a new device that has joined the network).
Example 6-9 ARPwatch Alert for a New MAC Address
|
Subject: new station |
(adsl) eth0 |
|
Date: Thu, 3 May 2007 |
11:16:12 +0200 |
|
From: "Arpwatch charly" <[email protected]> |
|
|
To: <[email protected]> |
|
|
hostname: |
adsl |
|
ip address: |
192.0.2.1 |
|
interface: |
eth0 |
|
ethernet address: |
0:4:27:fd:52:40 |
|
ethernet vendor: |
Cisco Systems, Inc. |
|
timestamp: |
Thursday, May 3, 2007 11:16:12 +0200 |
Example 6-10 shows the alert generated when ARPwatch detects a possible ARP spoofing attack: It has received an ARP reply packet that contradicts the binding <IP, MAC> of Example 6-9.
Mitigating Other ARP Vulnerabilities 117
|
From: [email protected] (Arpwatch charly) |
||||
|
Subject: changed ethernet address (adsl) eth0 |
||||
|
Date: Thu, 3 May 2007 13:31:15 +0200 (CEST) |
||||
|
hostname: |
adsl |
|||
|
ip address: |
192.0.2.1 |
|||
|
interface: |
eth0 |
|||
|
ethernet address: |
0:15:58:27:83:dc |
|||
|
ethernet vendor: |
<unknown> |
|||
|
old ethernet address: |
0:4:27:fd:52:40 |
|||
|
old ethernet vendor: |
Cisco Systems, Inc. |
|||
|
timestamp: |
Thursday, May 3, 2007 13 |
31 |
14 |
+0200 |
|
previous timestamp: |
Thursday, May 3, 2007 13 |
29 |
23 |
+0200 |
|
delta: |
1 minute |
|||
Continue reading here: Motivation for IPv6
Was this article helpful?